Deduplicate artifact bytes and deliver files by authenticated hash

agent/tests/test_agent.py

@@ -832,6 +832,26 @@ class AgentTests(unittest.TestCase):
         self.assertEqual(result["state"], "completed", result)
         return payload
 
+    def test_hash_file_downloads_are_verified_and_staged_as_writes(self):
+        self.create()
+        content = b"downloaded plugin"
+        sha = module.digest(content)
+        file = {"id": 1, "path": "configs/server.cfg", "contentSha256": sha, "sha256": sha}
+        with patch.object(self.agent, "artifact_open", return_value=Response(content)) as fetch:
+            result = self.agent.stage(INSTANCE, 1, {"stageId": "hash-stage", "files": [file]}, "hash-operation")
+        self.assertEqual(result["state"], "staged")
+        self.assertTrue(fetch.call_args.args[1].endswith("/api/agent/blobs/" + sha))
+        manifest = json.loads((self.agent.instance_dir(INSTANCE, 1) / "stages/hash-stage/manifest.json").read_text())
+        self.assertFalse(manifest["files"][0]["delete"])
+        self.assertEqual(base64.b64decode(manifest["files"][0]["contentBase64"]), content)
+        with patch.object(self.agent, "artifact_open", return_value=Response(b"wrong bytes")):
+            with self.assertRaisesRegex(AgentError, "checksum mismatch"):
+                self.agent.decode_file(file)
+        with patch.object(self.agent, "artifact_open") as fetch:
+            with self.assertRaisesRegex(AgentError, "Invalid file content hash"):
+                self.agent.decode_file({"contentSha256": "../../secret"})
+            fetch.assert_not_called()
+
     def test_same_id_reports_saved_result_without_executing_again(self):
         self.create()
         operation = self.operation("instance.restart")